278 Commits

Author SHA1 Message Date
J Logan a23bcf0061 Propagate host ssh socket permissions to relay socket in guest. (#811)
- Closes #580.
- Depends on apple/containerization#362.

## Type of Change
- [x] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
0.6.0
2025-10-27 14:46:27 -07:00
Danny Canter 9f8a0fb87d Build: Fallback to Containerfile if Dockerfile not found (#812)
Closes #782 #99

If a Dockerfile can't be found in the context dir, check for the common
alternative Containerfile. This does not implement .containerignore
also, solely Containerfile for now. This also funnily enough fixes us
not checking for the Dockerfile IN the context directory.. woops.

## Type of Change
- [x] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-10-27 08:28:29 -07:00
Dmitry Kovba f2b3cbdd73 Lowercase stdin, stdout, stderr (#807)
Lowercased stdin, stdout, stderr.
2025-10-25 06:55:45 -07:00
Dmitry Kovba 4944fe1641 Use a consistent capitalization in log and error messages (#806)
Updates the capitalization in log and error messages to be consistent.
2025-10-24 19:18:32 -07:00
J Logan 8f2e20de5a CZ 0.12.1 - pick up relay fixes, other goodies. (#804) 2025-10-24 14:52:39 -07:00
Danny Canter b4528924dc Dns: Fix delete error message (#803) 2025-10-24 14:04:47 -07:00
J Logan 5de195f720 Bump Containerization to 0.12.0. (#802)
- Include change to bootlog API.
2025-10-23 14:26:45 -07:00
Saehej Kang 671725c815 [command-reference]: Document what "auto" means in container run (#765)
## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [x] Documentation update

## Motivation and Context

Closes #746

## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
2025-10-22 13:49:54 -07:00
Danny Canter da501ce620 Raise createEndpoint response timeout (#797) 2025-10-21 18:09:37 -07:00
Raj b4c3ebfed8 add volume prune command (#783)
- Closes #508.

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Adds a `container volume prune` command that removes volumes with no
container references and reports the amount of disk space reclaimed.
This helps users clean up unused volumes and easily reclaim disk space.

Also updates the `volume delete` documentation to clarify and highlight
how the `--all` flag works.

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-10-21 16:58:11 -07:00
Danny Canter 2f507fe9d9 Make container start idempotent (#792)
Fixes #772 

Today it fails in bootstrap the second go around, and we also have an
error handler that automatically cleans up the container if bootstrap
failed which is even worse. This change short circuits us first in the
cli if the state is running when we get() the container, and also adds
in a clause to bootstrap to just early return if we already have a
client.
2025-10-21 14:42:32 -07:00
Danny Canter b4814f0c4a Deps: Bump Containerization to 0.11.0 (#796) 2025-10-21 14:28:52 -07:00
Danny Canter 109d4b4393 Integration: Fix image inspect error message (#795)
container -> image
2025-10-21 13:26:27 -07:00
Raj ce40ffd33d add support for multiple --tag flags in build (#785)
- Closes #732.

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Adds support for specifying multiple `-t` / `--tag` flags with the
`build` command. All specified tags will point to the same built image.

Example:
`container build -t myapp:latest -t myapp:v1.0.0 -t myapp:stable .`

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-10-21 13:03:46 -07:00
Saehej Kang d610a85703 [container-run-create]: add support for --network none (#739)
Closes #386
2025-10-21 11:18:06 -07:00
Melissa Kilby ae279105a2 chore: restrict GitHub workflow permissions - future-proof (#781)
See https://github.com/swiftlang/github-workflows/issues/167 for
additional context

This approach aligns with security best practices, as detailed in the
following documentation:

-
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
-
https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defining-access-for-the-github_token-scopes
-
https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/


The default GITHUB_TOKEN permissions are defined at the repository
level. This PR modifies the workflow-level overrides to conform to
OpenSSF best practices -> defense in depth.

Allow me to quote OpenSSF:

https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

> The highest score is awarded when the permissions definitions in each
workflow's yaml file are set as read-only at the top level and the
required write permissions are declared at the run-level.”

> Remediation steps
> - Set top-level permissions as read-all or contents: read as described
in GitHub's documentation.
> - Set any required write permissions at the job-level. Only set the
permissions required for that job; do not set permissions: write-all at
the job level.


Compare to the LLVM project:

Top-level: contents read, e.g.
https://github.com/swiftlang/llvm-project/blob/next/.github/workflows/build-ci-container-windows.yml#L3-L4
-> this makes it future-proof

Job-level: Allow write permissions as needed, e.g.
https://github.com/swiftlang/llvm-project/blob/next/.github/workflows/build-ci-container-windows.yml#L53-L58

Signed-off-by: Melissa Kilby <mkilby@apple.com>
2025-10-17 15:03:41 -07:00
Kathryn Baldauf 7bfdcc9940 Revert "added the new workflow that automatically puts the labels in PR" (#776)
Reverts apple/container#741

The action does not have permissions to add labels. Reverting this while
we investigate the right fix

@Ronitsabhaya75 heads up
2025-10-16 18:08:54 -07:00
Ronit Sabhaya f49059fb7b added the new workflow that automatically puts the labels in PR (#741)
## Type of Change
- [ ] New feature : This can help dev teams to particularly look on
those things are differently and understand what has been changed
through labels


@dcantah can you please review this pr and suggest me if any changes
require

---------

Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Co-authored-by: Kathryn Baldauf <k_baldauf@apple.com>
Co-authored-by: Bisman Sahni <139563284+bismansahni@users.noreply.github.com>
Co-authored-by: J Logan <john_logan@apple.com>
2025-10-16 17:41:29 -07:00
Saehej Kang 27eee1e7f9 [container-system-dns-ls]: add --format and --quiet options (#720)
Closes #510
2025-10-16 16:18:52 -07:00
GenkaOk d9ca04f553 Update make-docs.sh to prevent HTML errors (#771)
Fix 2 HTML errors:
1) Start tag seen without seeing a doctype first. Expected <!DOCTYPE
html>.
2) Element head is missing a required instance of child element title.
2025-10-16 14:56:48 -07:00
Raj 2f8de3a660 Implicitly create named volumes (#769)
- Closes #690.

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Named volumes are now implicitly created when referenced in container
commands. So, if `myvolume` doesn't exist and you run `container run -v
myvolume:/data alpine`, it is automatically created.

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-10-16 14:48:57 -07:00
Raj f90f67ccf0 Add support for anonymous volumes (#768)
- Closes #726.

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Adds support for anonymous volumes. Users can now create volumes without
explicit naming using `-v /path` and `--mount type=volume,dst=/path`
syntax.

Usage:
```
# anonymous volume  
container run -v /data alpine
container run -v anon-01k7jpghe4kg4ph5a4vkccksbb:/data alpine

# Multiple anonymous volumes
container run --rm -v /logs -v /cache -v /tmp alpine
```

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs
2025-10-15 17:33:49 -07:00
J Logan 78701f1b73 Add app bundle Info.plist as a system property source. (#764)
- Closes #708.
- Allows `container` and services/plugins to get backstop defaults from
  `Info.plist` properties if repackaged into a signed app bundle.
2025-10-14 17:00:03 -07:00
Kathryn Baldauf 6cb40b3687 Add image env variables to builder start command (#756)
## Type of Change
- [x] Bug fix

## Motivation and Context
Required for builder to run correctly with bug fix in containerization
here https://github.com/apple/containerization/pull/329. Builder was
previously not passing any environment variables when starting the
initial process.

## Testing
- [x] Tested locally

---------

Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
2025-10-14 11:13:18 -07:00
siikamiika d8eb510e1e Support --subnet in network create (#737)
> [!CAUTION]
> Just noticed you can actually create a network that conflicts with an
existing network not managed by `network create`. Unless that is fine do
not merge!

Currently containerization only supports IPv4.

Example:
<img width="2012" height="578" alt="screenshot"
src="https://github.com/user-attachments/assets/38fef1ef-3ffd-4d77-b9e2-8c43f7e4851d"
/>



Docker ref: https://docs.docker.com/reference/cli/docker/network/create/
Podman ref:
https://docs.podman.io/en/v5.0.3/markdown/podman-network-create.1.html#subnet-subnet

Fixes apple/container#458

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
[Why is this change needed?]

Scripted creation of deterministic network environments for containers

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
2025-10-13 16:30:10 -07:00
Eric Ernst 89c69d6271 make: add coverage target (#685)
To facilitate ability to gather code coverage metrics without slowing
down our integration target, let's add a coverage target.

From this we can run `xcrun llvm-profdata merge` to get profdata and
gather overall code coverage metrics

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
[Why is this change needed?]

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs

Signed-off-by: Eric Ernst <eric_ernst@apple.com>
2025-10-13 15:21:32 -07:00
J Logan 77e68a7613 Moves .build directory to builder. (#749)
Closes #416.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [x] Breaking change (possibly, I would think we're just going to leave
an unused `.build` directory behind which we can document, but can run
more tests next week).
- [ ] Documentation update

## Motivation and Context
We have nothing to hide?

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-10-10 10:19:05 -07:00
J Logan bc70b39182 Fix broken proxy configuration for default kernel fetch. (#747)
- Closes #466.

## Type of Change
- [x] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Proxy logic worked well enough for CI but broken in general.

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [ ] Added/updated docs
2025-10-10 10:17:42 -07:00
Bisman Sahni 0d3f20c4ca Fix race condition in ContainersService.create() (#721)
Fixes #692 

This PR resolves a race condition in `ContainersService.create()` that
occurs when creating containers with the same name concurrently.
2025-10-08 17:30:06 -07:00
Kathryn Baldauf 23b058c53c Remove StandardErrorPath and StandardOutPath from launchd plists (#742)
## Type of Change
- [x] Bug fix

## Motivation and Context
We setup logging for the services in `container` using OSLog. See
[here](https://github.com/apple/container/blob/73709232d2705b7008b7380fe90a373059b6074a/Sources/Helpers/APIServer/APIServer.swift#L31).
This makes it unnecessary to redirect stderr and stdio for these
services. Additionally, there are some cases where failure to open or
write to the path given for StandardErrorPath or StandardOutPath in a
service's plist could result in a failure to start a service through
`launchctl`.

Related to https://github.com/apple/container/discussions/713

## Testing
- [x] Tested locally

Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
2025-10-08 16:08:08 -07:00
Danny Canter 73709232d2 CLI: Fix env-file parsing (#707)
Closes #691

Any envvars that had equal signs in the value would be ommitted today.
This change brings it much more in line with docker's behavior/parser
and adds unit tests to verify this is the case.
2025-10-06 12:12:50 -07:00
J Logan bfc5ca9222 Removes "all rights reserved" from license header. (#711)
Closes #63.
2025-10-03 13:28:16 -07:00
Dmitry Kovba 48230f3804 Update license headers in C files (#693)
## Type of Change
- [x] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
There was a duplicated and outdated license header in some files.

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
0.5.0
2025-10-02 09:42:24 -07:00
J Logan ffc1195556 Remove references to macOS 26 beta. (#702)
## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [x] Documentation update
2025-10-01 15:27:35 -07:00
J Logan d045e5b0f0 Updates containerization to 0.9.1. (#697)
- Converts client to work with ExitStatus instead of integer error
codes.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [x] Breaking change (SandboxClient.wait() returns ExitStatus instead
of Int32, apple/containerization#300)
- [ ] Documentation update

## Motivation and Context
Pick up DNS bug fix, update for breaking API change.

## Testing
- [x] Tested locally
- [x] Added/updated tests (fixed DNS test, using correct `options` now,
apple/containerization#303).
- [ ] Added/updated docs
2025-10-01 10:04:39 -07:00
Dmitry Kovba 60cff76a5a Update an issue template (#694)
This PR adds the default value "N/A" to the logs section to prevent it
from being empty in most issues.
2025-10-01 09:43:53 -07:00
Dmitry Kovba 69fd9484b9 Fix races in the SandboxService actor due to reentrancy after await calls (#684)
This PR fixes several races with the `stop()` and `shutdown()` methods
by moving all state transitions inside a lock.

## Type of Change
- [x] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
[Why is this change needed?]

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-09-25 18:35:51 -04:00
J Logan 2b07e890c7 Relocate ProcessIO to ContainerClient. (#681)
- Makes ProcessIO more generally available.
- `Application.handleProcess(processIO:process:)` becomes
`processIO.handleProcess(process:log:)`.

## Motivation and Context
This code shouldn't be in the CLI, it should be part of ContainerClient.
2025-09-24 18:02:34 -07:00
J Logan 0fe44a04fb Adds a plain stderr log handler. (#680)
- Initial work for #642. CLI commands will configure this log handler so
that they write warnings and errors to stderr, and only proper output
will go to stdout.
- Facilitates #507. The `--debug` option can set the logging level
appropriately, and CLI commands can just use `log.debug()`.

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update
2025-09-24 13:57:34 -07:00
Kathryn Baldauf 96ba14bc21 Add warning note on finding docs for release versions (#676)
## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [x] Documentation update

## Motivation and Context
Closes https://github.com/apple/container/issues/638. This PR adds a
warning in the README for the documentation links to help newcomers find
the correct documentation based on the version of `container` they are
running.

## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs

Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
2025-09-23 15:22:58 -07:00
J Logan e54ee7cb4e Fix regression - removed shutdown XPC inadvertently. (#675)
## Motivation and Context
#654 forgot to include the shutdown XPC that was added in #628.
2025-09-23 14:50:14 -07:00
J Logan e448151f7e Bumps containerization to 0.8.1. (#674)
## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Avoid build errors due to NIOFilesystem import issues in
containerization.

## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-09-23 13:15:35 -07:00
J Logan e7018bc30b Cleans up image subcommand options. (#659)
- Part of #515.
- Order options alphabetically.
- Use consistent descriptions for platform, os, arch.
- Add os/arch options to push.
- Rename ImageRemove to ImageDelete since delete is the primary command
and rm is the alias.

## Motivation and Context
Clear, consistent presentation of command help.
2025-09-23 10:55:04 -07:00
J Logan 076d28ebb1 Add and use container-runtime-linux start. (#654)
- Part of #653.
- No need for `defaultCommand` since ContainerService startup will write
a new launchd plist with the `start` subcommand included.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Allows us to add commands to support post-installation, migration, etc.

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-09-23 10:05:06 -07:00
J Logan e460ca9252 Add and use container-apiserver start. (#655)
- Part of #653.
- Also use same file organization for network helper.

## Motivation and Context
Future-proof plugin CLIs.
2025-09-23 10:01:02 -07:00
J Logan f3b33ffc45 Cleans up option groups, container subcommand help. (#647)
- Part of #515.
- Add titles to option groups for container subcommands.
- Order option groups and container subcommand options alphabetically.
- Use `container-id` and `container-ids` consistently as argument names.
- Shorten long valueNames to avoid option column overflow in help output
where possible.
- Replace customShort and customLong with short, long, and shortAndLong
where possible.
- Always place global options and arguments after alphabetized
command-specific options.
- Rename RunCommand to ContainerRun and relocate it.
- Rename Executable to ContainerCLI.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [x] Breaking change (if you're depending on `RunCommand`, renamed).
- [ ] Documentation update

## Motivation and Context
See #385.

## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs
2025-09-22 16:36:07 -07:00
Danny Canter 7df9763aa5 ClientContainer: Remove response timeout from stop (#667)
After the large reworks, I'm not as worried about having this timeout
anymore. Prior to the reworks stop was signaled via an async event sent
to the daemon as stop was performed directly on the given runtime-helper
instance. If anything errored during that it was common for things to
explode, but now that stop is:

client -> APIServer -> runtime-helper instance

and the logic for stop has been improved quite a bit, in addition to
stop no longer holding a lock during it's operation, I'm not sure we
need this. In the future it'd also be nice to support no timeout (the
timeout until we send SIGKILL, not response timeout) in which case we'd
have to have an extra bit of logic here to skip the response timeout in
that scenario anyways.
2025-09-22 14:17:38 -07:00
J Logan bcfcd5ac19 Cleans up registry subcommand options. (#660)
- Part of #515.
- Order options alphabetically.

## Motivation and Context
See #515.
2025-09-22 13:18:20 -07:00
J Logan 1f94a8340a Cleans up build subcommand options. (#658)
- Part of #515.
- Order options alphabetically.
- Use `container ls` options for `builder status`.

## Type of Change
- [ ] Bug fix
- [ ] New feature  
- [x] Breaking change - Change options and output of `builder status`.
- [x] Documentation update

## Motivation and Context
See #515.

## Testing
- [x] Tested locally
- [ ] Added/updated tests
- [x] Added/updated docs
2025-09-22 12:48:45 -07:00
J Logan 7d905bde64 Cleans up network and volume subcommands. (#661)
- Part of #515.
- Order options alphabetically.
- Use consistent delete logic for network and volume delete.

## Motivation and Context
See #515
2025-09-22 12:17:24 -07:00